CVE-2026-44277

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests...

CVE-2026-44277

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests...

CVE-2026-44277

Affected vendor/product : Fortinet FortiAuthenticator. Versions affected : 8.0.2, 8.0.0, 6.6.0–6.6.8, 6.5.0–6.5.6. Vulnerability type : improper access control. Impact : may allow an attacker to execute unauthorized code or commands via an attack vector (not specified in the provided documents). ...

CVE-2026-20887

Intel Vision software (all Ring 3 versions) is affected by CVE-2026-20887 due to improper access control. An unprivileged, unauthenticated attacker could trigger a low-complexity remote attack over the network to achieve remote code execution, with potential impacts to confidentiality (HIGH), and...

Microsoft Word for Android Spoofing Vulnerability

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally...

Azure Logic Apps Elevation of Privilege Vulnerability

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

Microsoft Office Spoofing Vulnerability

Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally...

Azure Connected Machine Agent Elevation of Privilege Vulnerability

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally...

PT-2026-40250

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...

PT-2026-40239

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot for Android affected versions not specified Description Improper access control in the intelligent virtual assistant allows an authorized attacker to perform spoofing attacks locally. Spoofing is a technique where a perso...

PT-2026-40210

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

PT-2026-40240

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally...

PT-2026-40241

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally...

PT-2026-40265

Name of the Vulnerable Software and Affected Versions FortiAuthenticator versions 8.0.0 through 8.0.2 FortiAuthenticator versions 6.6.0 through 6.6.8 FortiAuthenticator versions 6.5.0 through 6.5.6 Description An improper access control issue in API endpoints allows an unauthenticated remote...

PT-2026-40257

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description Improper access control allows an unauthorized attacker to perform spoofing locally...

PT-2026-40136

Name of the Vulnerable Software and Affected Versions Windows Filtering Platform affected versions not specified Description Improper access control in the Windows Filtering Platform WFP allows an authorized attacker to bypass a security feature locally. Recommendations At the moment, there is no...

Siemens Ruggedcom Rox

SUMMARY Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remote attacker to read arbitrary files with root privileges from the underlying operating system's filesystem. Siemens has released new versions for the affected products and recommends to...

EUVD-2026-29116

HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/ and /interview/ endpoints. The route handlers retrieve records by the user-supplied ID without verifying that the requesting user is the owner or has an authoriz...

CVE-2026-45006 OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection. Attackers can persist malicious config...